Cisco Systems EDCS-154011 manual Introduction

Page 3

Introduction

This paper explains how to set up the Cisco Secure PIX firewall for use in Cisco IP/VC H.323 deployments. The configuration that will be shown below will be a two-interface PIX 515 running version 6.01 and utilizing NAT. The goals of this paper are:

1.Describe the issues with firewalls and H.323

2.Describe how to set up the firewall to allow H.323 video traffic to pass

3.Describe how to allow a terminal outside the firewall to register with a GK on the inside of the firewall.

4.Describe how to allow a terminal outside the firewall to communicate with a terminal on the inside of the firewall.

Where appropriate, this paper refers to existing procedures in the following Cisco user guides:

Cisco IP/VC Videoconferencing Design Guide

Managing Cisco Network Security

This guide assumes the user has basic PIX knowledge. For detailed PIX configuration steps, see the online documentation below:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_60/index.htm

Use the following link to download PIX code:

http://www.cisco.com/kobayashi/sw-center/internet/pix.shtml

Note: For those who are new to the Cisco IP/VC videoconferencing product family and the Cisco Secure PIX Firewall, it is highly recommended that you first review the users guides referenced above, as this paper is designed to enhance your understanding of the products beyond that of the new user.

Copyright © 2001 Cisco Systems, Inc.

Page 3 of 11

Image 3
Contents An IP/VC Application Note Table of contents Introduction What is the Cisco Secure PIX Firewall? Issues with Firewalls and H.323Implementing NAT for use with in-bound H.323 traffic What is NAT?Two Interface PIX with NAT Diagram Configuration Description Static command Breaking down the PIX configuration Fixup protocol CommandAccess-list command Access-list aclout permit tcp any host Access-group aclID in interface interfacenameAccess-group aclout in interface outside Helpful Links Typical Ports used for H.323 traffic